spuru9 opened a new pull request, #175: URL: https://github.com/apache/flink-shaded/pull/175
## What Bump the bundled Jackson on the `release-21.0` line from `2.20.1` to `2.21.5`, and update the affected `NOTICE` files and hardcoded module version coordinates to match. JIRA: https://issues.apache.org/jira/browse/FLINK-41076 (relates to FLINK-39570; the Netty counterpart is #174) ## Why `2.21.5` is the first release on a supported `2.x` line that fixes a series of `jackson-databind` / `jackson-core` CVEs and GHSA advisories that affect `2.20.1`. `2.20.x` has no fixed release for any of them, so a bump to a newer minor is required: | Advisory | Package | Affected range (2.x) | Fixed in | |---|---|---|---| | CVE-2026-54512 | jackson-databind | 2.19.0 – 2.21.3 | 2.21.4 | | CVE-2026-54513 | jackson-databind | 2.19.0 – < 2.21.4 | 2.21.4 | | CVE-2026-54514 | jackson-databind | 2.19.0 – < 2.21.4 | 2.21.4 | | CVE-2026-59888 | jackson-databind | 2.19.0 – < 2.21.4 | 2.21.4 | | CVE-2026-54515 | jackson-databind | 2.19.0 – < 2.21.5 | 2.21.5 | | CVE-2026-59889 | jackson-databind | 2.19.0 – < 2.21.5 | 2.21.5 | | GHSA-r7wm-3cxj-wff9 (CVE-2026-68494) | jackson-core | 2.19.0 – < 2.21.4 | 2.21.4 | | GHSA-mhm7-754m-9p8w | jackson-databind | 2.18.0 – 2.18.8, 2.21.0 – 2.21.4 | 2.21.5 | `2.21.5` clears every one of these `2.21.x` fix thresholds. Because `flink-shaded` bundles (relocates) Jackson, consumers of `flink-shaded-jackson` / `flink-shaded-jackson-module-jsonSchema` / `flink-shaded-swagger` can only pick up these fixes via a rebuild of the shaded artifacts from a bumped source branch — the bundled copy is invisible to downstream `dependencyManagement`. This is the 21.0 counterpart of #166 (`release-20.0`, Jackson 2.18.10). Unlike #166 it moves a minor version (`2.20` → `2.21`), since `2.20.x` has no fixed release. ## Changes - **`pom.xml`** — `jackson.version` `2.20.1` → `2.21.5`. - **`flink-shaded-jackson-parent/pom.xml`** — hardcoded `<version>2.20.1-21.0</version>` → `2.21.5-21.0` (this module's version coordinate is `<jackson.version>-<flink-shaded-revision>` by convention, not a resolvable property). - **`flink-shaded-jackson-parent/flink-shaded-jackson-2/pom.xml`**, **`flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/pom.xml`**, **`flink-shaded-jackson-parent/flink-shaded-jsonpath/pom.xml`** — matching `<parent><version>` bump to `2.21.5-21.0`. - **`flink-shaded-jackson-parent/flink-shaded-jackson-2/src/main/resources/META-INF/NOTICE`** — 7 bundled `com.fasterxml.jackson.*` version lines → `2.21.5`. - **`flink-shaded-jackson-parent/flink-shaded-jackson-module-jsonSchema-2/src/main/resources/META-INF/NOTICE`** — 3 bundled `com.fasterxml.jackson.*` version lines → `2.21.5`. - **`flink-shaded-swagger/src/main/resources/META-INF/NOTICE`** — the 2 bundled `com.fasterxml.jackson.*` lines → `2.21.5`. This module imports `com.fasterxml.jackson:jackson-bom:${jackson.version}` in `dependencyManagement`, so the bump changes the Jackson it bundles too. `flink-shaded-jsonpath` keeps its own `2.10.0` version; only its `<parent>` version changes. ## Verification Built locally with Maven 3.9.4 / Java 21 against Maven Central, `mvn clean deploy -Plicense-check` on `flink-shaded-jackson-2`, `flink-shaded-jackson-module-jsonSchema-2`, `flink-shaded-jsonpath` and `flink-shaded-swagger` (with `-am`): - `BUILD SUCCESS` for all modules in the reactor. - `LicenseChecker` (`exec:java@check-license`): "License check completed without severe issues." - `flink-shaded-jackson-2-2.21.5-21.0.jar`: the relocated `PackageVersion` classes for `jackson-core` and `jackson-databind` report `2.21.5`; 1268 classes under `org/apache/flink/shaded/jackson2/com/fasterxml/jackson`, 0 un-relocated `com/fasterxml/jackson` classes. - `flink-shaded-jackson-module-jsonSchema-2` (1167 relocated, 0 un-relocated) and `flink-shaded-swagger` (87 relocated, 0 un-relocated) likewise. Only the Jackson modules were built; unit tests were not run. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (claude-sonnet-5-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
